I have two accounts, an administrator and a simple user. I can capture the administrator's cookie and use it in a simple user request, I find myself logged in with the administrator user and then log in to the site as an administrator user. Can I consider this vulnerability a privilege escalation? How should the cookie be mitigated?

  • 3
    What do you mean by "capture the administrator's cookie"? How do you capture it? – Anders Dec 5 '19 at 13:31
  • Do you sniff the traffic and take it from there? Do you extract it from your browser? – Anders Dec 5 '19 at 13:36
  • 1
    How you "capture the cookie" defines the vulnerability here. – schroeder Dec 5 '19 at 13:39
  • @Anders Suppose I can capture a user's cookie with privileges for example through an xss attack. Then I access the vulnerable application with my data (simple user) and by replacing my cookie with that of the privileged user, I can access sections of the application with the victim's account. Can I consider this attack a privilege escalation? – moskino11 Dec 5 '19 at 13:49
  • @moskino11 But can you actually? Does the application have an XSS vulnerability? And are the cookies stored without the HTTPOnly attribute? – MechMK1 Dec 5 '19 at 14:05

From the way you are wording this question and your comments, it sounds like this is a hypothetical. So I will treat it as such.

What you've described in your question is privilege escalation: you are starting with a user account, stealing a session cookie, and then using it to escalate your privileges to admin. However this may not be how the vulnerability is classified. In your example, there is a user and an admin account. In your comment you said

"Suppose I can capture [the admin's] cookie with privileges for example through an XSS attack."

If the site is vulnerable to XSS, then the vulnerability here would be XSS. While you are performing privilege escalation by grabbing the admin session, you are using XSS to do it. Fixing this vulnerability would be done by patching the vector for code injection.

If this does not answer what you are asking, please clarify what you are looking for. Your question is a little vague and seems to be asking about a definition.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.